Move theme family selection to userConfig and save Branding edits to app config

### Summary

Top PR of the app-config stack (base: FR-1964's app-config serving, which sits on FR-3605's v2 document): move theme family selection to userConfig and make the Branding editor save to app config. PR: #9362.

### Scope

- **Theme family → userConfig** — `userConfig.themeFamily` becomes the authoritative store, written from User Settings via a USER-scope raw read + upsert (`useUpdateMyUserAppConfig`). localStorage (`backendaiwebui.settings.themeFamily`) is demoted to the FOUC mirror the `index.html` bootstrap reads: synced on login by `ThemeFamilyUserConfigSync`, cleared on logout.
- **Branding Apply → app config** — Apply saves the whole v2 draft to the `appearance` subKey of `publicConfigByDomain` and reloads the page on success (the reloaded page is the feedback; no refresh API). Preview becomes a secondary button; the "contact support" banner is removed.

**(The `custom_primary_color` / `ThemeAccentColorPicker` removal moved down to FR-3605 — it is coupled to the v1→v2 internal-currency switch, not to the userConfig work.)**

### Acceptance criteria

- Theme family chosen in User Settings follows the user across browsers/devices (userConfig), with no FOUC on reload.
- Superadmin Branding Apply persists the domain document server-side; a plain reload shows the applied appearance.

JIRA Issue: FR-3834

Start with PR #9362 and trace the User Settings theme-family flow through ThemeFamilyUserConfigSync, the index.html bootstrap mirror, and useUpdateMyUserAppConfig. Then inspect the Branding editor's appearance update path and publicConfigByDomain handling. Done means userConfig follows the user across devices without FOUC, and Branding Apply persists the domain document so a plain reload shows the appearance.

Written by the indexing model from the issue text.